I created a new LiveView application and installed sobelow, which immediately gives me a finding of:

Config.CSWH: Cross-Site Websocket Hijacking - Low Confidence
File: lib/my_project_web/endpoint.ex
Line: 18

which refers to the LiveView socket:

socket "/live", Phoenix.LiveView.Socket, websocket: [connect_info: [session: @session_options]]

So to solve a potential problem, I added a check_origin: true option to the websocket options, but the finding is still there. Looking at the source, it seems that the finding will always be present, if there are any websocket options given as a keyword list, regardless of whether the origin is checked or not. Only the confidence varies:

  defp check_socket_options([{:websocket, options} | _]) when is_list(options) do
    case options[:check_origin] do
      false -> {true, :high}
      _ -> {true, :low}
    end
  end

I’m uncomfortable ignoring security warnings without grokking why the warning is there in the first place, so I’d definitely like to understand this more. Would checking the origin not actually solve the problem? Am I misunderstanding something about the vulnerability? Or should I open a pull-request to insert a true -> {false, :high} clause?